URL:

https://www.oglaf.com

Full analysis: https://app.any.run/tasks/a8f14b12-0fdd-4862-a6d0-5a9ad2e138b8
Verdict: No threats detected
Analysis date: October 03, 2019, 06:15:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
MD5:

9FF7BDF379D3F5CDEF5E9E16B0B1E21A

SHA1:

0A64FF3E81C87671571DADC070F4BE2E11AC512D

SHA256:

445205FD18AA9B7C7303D92EEE3E16B6B0A05C32D92D7C1E51978F3DFF2EF143

SSDEEP:

3:N8DSL6ZI:2OLP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Creates files in the user directory

      • opera.exe (PID: 2708)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
1
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start opera.exe

Process information

PID
CMD
Path
Indicators
Parent process
2708"C:\Program Files\Opera\opera.exe" "https://www.oglaf.com"C:\Program Files\Opera\opera.exe
explorer.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Internet Browser
Exit code:
0
Version:
1748
Modules
Images
c:\program files\opera\opera.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\psapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rpcrt4.dll
Total events
265
Read events
205
Write events
60
Delete events
0

Modification events

(PID) Process:(2708) opera.exeKey:HKEY_CURRENT_USER\Software\Opera Software
Operation:writeName:Last CommandLine v2
Value:
C:\Program Files\Opera\opera.exe "https://www.oglaf.com"
(PID) Process:(2708) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
0
Suspicious files
55
Text files
136
Unknown types
3

Dropped files

PID
Process
Filename
Type
2708opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\sessions\opr94D.tmp —
MD5:—
SHA256:—
2708opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr95E.tmp —
MD5:—
SHA256:—
2708opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr9AD.tmp —
MD5:—
SHA256:—
2708opera.exeC:\Users\admin\AppData\Local\Opera\Opera\cache\sesn\opr00001.tmp —
MD5:—
SHA256:—
2708opera.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CJ1P5X408OCBDZ46RD9Q.temp —
MD5:—
SHA256:—
2708opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.initext
MD5:—
SHA256:—
2708opera.exeC:\Users\admin\AppData\Local\Opera\Opera\icons\www.oglaf.com.idxtext
MD5:—
SHA256:—
2708opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xmlxml
MD5:—
SHA256:—
2708opera.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\16ec093b8f51508f.customDestinations-msbinary
MD5:—
SHA256:—
2708opera.exeC:\Users\admin\AppData\Local\Opera\Opera\icons\https%3A%2F%2Fstatic.oglaf.com%2Ffavicon.pngimage
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
22
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2708
opera.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQC%2BEwNpD8GHOAgAAAAAExeO
US
der
472 b
whitelisted
2708
opera.exe
GET
200
192.35.177.64:80
http://crl.identrust.com/DSTROOTCAX3CRL.crl
US
der
896 b
whitelisted
2708
opera.exe
GET
200
195.138.255.16:80
http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgM7ZeWUsIumDbx5a%2BpQ7iYIiQ%3D%3D
DE
der
527 b
whitelisted
2708
opera.exe
GET
200
172.217.16.131:80
http://crl.pki.goog/gsr2/gsr2.crl
US
der
950 b
whitelisted
2708
opera.exe
GET
200
93.184.220.29:80
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl
US
der
528 b
whitelisted
2708
opera.exe
GET
200
195.138.255.16:80
http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgMuodNWoF7yX9GcZ%2BFve8Q9uw%3D%3D
DE
der
527 b
whitelisted
2708
opera.exe
GET
200
195.138.255.16:80
http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgPIrKcl4VqN0rFo3EJArsGmUw%3D%3D
DE
der
527 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2708
opera.exe
185.26.182.94:443
certs.opera.com
Opera Software AS
—
whitelisted
2708
opera.exe
62.113.194.12:443
www.oglaf.com
23media GmbH
DE
suspicious
2708
opera.exe
195.138.255.16:80
ocsp.int-x3.letsencrypt.org
AS33891 Netzbetrieb GmbH
DE
suspicious
2708
opera.exe
107.167.110.211:443
sitecheck2.opera.com
Opera Software Americas LLC
US
suspicious
2708
opera.exe
216.58.207.78:443
www.google-analytics.com
Google Inc.
US
whitelisted
2708
opera.exe
192.35.177.64:80
crl.identrust.com
IdenTrust
US
malicious
2708
opera.exe
93.184.220.29:80
crl4.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2708
opera.exe
185.26.182.93:443
certs.opera.com
Opera Software AS
—
whitelisted
2708
opera.exe
172.217.16.131:80
crl.pki.goog
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.oglaf.com
  • 62.113.194.12
whitelisted
sitecheck2.opera.com
  • 107.167.110.211
  • 107.167.110.216
whitelisted
certs.opera.com
  • 185.26.182.94
  • 185.26.182.93
whitelisted
crl.identrust.com
  • 192.35.177.64
whitelisted
ocsp.int-x3.letsencrypt.org
  • 195.138.255.16
  • 195.138.255.24
whitelisted
crl4.digicert.com
  • 93.184.220.29
whitelisted
static.oglaf.com
  • 62.113.194.12
whitelisted
www.google-analytics.com
  • 216.58.207.78
whitelisted
media.oglaf.com
  • 62.113.194.12
whitelisted
crl.pki.goog
  • 172.217.16.131
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.oglaf.com